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We study the symmetric-side-channehassisted private capacity of a quantum channel, for which we 
provide a single-letter formula. This capacity is additive, convex, and, for degradable channels, equal 
to the unassisted private capacity. While a channel's (unassisted) capacity for for private classical 
communication may be strictly larger than its quantum capacity, we will show that these capacities 
are equal for degradable channels, thus demonstrating the equivalence of privacy and quantum 
coherence in this context. We use these ideas to find new bounds on the key rate of quantum key 
distribution protocols with one-way classical post-processing. For the Bennett-Brassard-84 (BB84) 
protocol, our results demonstrate that collective attacks are strictly stronger than individual attacks. 



I. INTRODUCTION 

One of the earliest results in quantum information theory 
was the realization in [l[ that a noisy quantum channel 
can be used to establish secret correlations whose security 
is guaranteed by the fundamental laws of physics. Fur- 
thermore, while the full-scale implementation of quantum 
computation is likely to remain a distant hope for years 
to come, secure quantum key distribution protocols may 
begin to play an important role in the world of informa- 
tion security in the not-too-distant future. 

In the simplest case of independent and identically dis- 
tributed noise, which we will consider here and to which 
most quantum key distribution (QKD) protocols can be 
reduced 0, H] , the capacity of a channel for private clas- 
sical communication was studied in In that work, a 
multi-letter formula for the private classical capacity was 
provided (and, indeed, a similar formula for a channel's 
capacity for quantum communication). Unfortunately, 
this multi-letter formula cannot be evaluated in general, 
and thus provides only a partial characterization of the 
capacity we seek. 

In lieu of a closed form expression for the private clas- 
sical capacity of a quantum channel, which we will call 
Cp, it is the primary purpose of this work to provide up- 
per bounds. In particular, we will consider the capacity 
of a quantum channel for private classical communica- 
tion when assisted by the family of (one-way) quantum 
channels that map symmetrically to their output and en- 
vironment. Since any such channel has zero private ca- 
pacity on its own, one would expect the resulting bound 
to be quite tight. This approach is very much in the 
spirit of , and in fact our expression for the symmetric 
side-channel assisted private capacity (ss-private capac- 
ity) shares many of the nice properties of the ss-capacity 
found there, namely it is single-letter, additive, and con- 



vex. 

A secondary goal of this work is to explore the connection 
between unconditional privacy and quantum coherence, 
which has long been folklore in the quantum information 
community and provided motivation for the coding theo- 
rems proved in Q (see also [1, 01)- While this analogy is 
quite useful, it is known that the correspondence is not 
exact. Indeed, there arc quantum channels for which the 
capacity for private communicaton and quantum com- 
munication are quite different. In Q it was shown that 
there exist quantum states from which no entanglement 
can be distilled via two-way classical communication but 
which nevertheless can be used to create secure key via 
one-way public classical communication. This leads to 
examples of channels with zero quantum capacity but 
nonzero private classical capacity. 

Understanding the connection between coherence and 
privacy in a quantitative way does not seem to be possible 
at the moment, as there do not yet exist simple expres- 
sions for either the private classical or quantum capacities 
of a channel. However, we will show below that, for the 
class of channels known as degradable, it is possible to 
find a simple expression for the private classical capac- 
ity, Cp, and indeed for such channels Cp is exactly the 
quantum capacity (which, due to Q has a closed-form 
expression). As well as giving the first examples of non- 
trivial channels for which Cp can be found explicitly, this 
provides a setting in which the above mentioned analogy 
between privacy and coherence can be made exact. 

Furthermore, the ss-privatc-capacity of a degradable 
channel is exactly equal to its (unassisted) quantum ca- 
pacity. We will combine this result with the convexity 
of the ss-private capacity to provide a new technique for 
upper-bounding the private capacity of a general quan- 
tum channel, extending the current best known bounds 
for the quantum capacity of the depolarizing to its private 
capacity and providing new bounds for private capacity 
of a channel with independent phase and amplitude noise. 
This last result leads to collective attacks on BB84 that 
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outperform the optimal individual attack. 
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The rest of the paper is organized as follows. In Section 
II we study the private capacity of a degradable channel, 
in Section III we provide a single-letter formula for the 
ss-private capacity of a general channel, while in Section 
IV we provide upper bounds for the private capacity of 
some specific quantum channels and discuss their relation 
to collective attacks in QKD. In Section V we mention a 
few open problems. 



II. NOISY PROCESSING IS NO HELP FOR 
DEGRADABLE U 

In a classical setting, if we imagine a broadcast channel 
which maps Af ■ X ^ {Y, Z), where Y is the output to 
the receiver and Z is the output of an eavesdropper, it 
was shown in that the secret-key capacity of A/" is 
exactly 

Cp(AA)= sup (/(r;y)-/(T;Z)). (1) 

Here the optimization is over a reference variable 
X, which represents the distribution of messages sent 
through the channel, together with a noisy processing of 
X that generates T. 

By analogy with this result, one may imagine that the 
private classical capacity of a quantum channel would be 
given by 

C(i) (Af) sup (/(T; B)^ - I{T; E)^) , 

{p,,\.p^)},X^T 

where luabe = Z]x,t P(*l^)p(^)l*X*U ® Uj^\ipx){'Px\Ulf 
with Uj\f an isometric extension of J\f (i.e., Af{p) ~ 
Ti'E Uj^pU\f). So, the optimization would again be taken 
over input random variable X (this time with a choice of 
basis), together with a classical noisy processing X T. 
Indeed, the coding theorem proved in [4| showed that this 
rate is in fact achievable: 



Cp(AA)>cW(AA), 

but did not establish the converse statement. Instead, it 
was shown that 

Cp{U) = lim -C(i)(AA®"). 

n — 'oo Tl 

Evidence was found in [llj that this regularization, as the 
limit over n is typically called in this context, is necessary 
in general. 

A class of channels for which we will be able to explicitly 
evaluate Cp are called degradable, and were defined in 
in analogy with the classical notion of a degraded 
broadcast channel (l^ . 



Definition 1 A channel N is called degradable if there 
exists a completely positive trace preserving degrading 
map V such that 

where Afip) = Tr^ Uj^pUlj- and Af{p) = Tr^ Uj^pUlf. 

Below, we will prove that the private classical capacity 
of a degradable channel is equal to its quantum capacity. 
The quantum capacity is, in turn, equal to the single- 
letter optimized coherent information. This result is very 
much in line with the findings of p^ . in which it was 
shown that in the classical case if Z is a degraded version 
of Y, the noisy processing in Eq. ([T]) is unecessary. 

Theorem 2 If Af is degradable, then 

CpiAf) = Q^'\Af) = sup/(A)i3),^^|^x^|, 

where I{A)B)p = S{B) - S{AB). 

To prove this, we will need the following lemma. 

Lemma SIfAf is degradable, then 

C(i)(AA) = Q(i)(AA) = sup/(A)B),^^|<^x^|. 



Proof Let Af be degradable, fix = J2xP'^\f^)(V''^\ ^^"^ 
let 

UJXTBE = ^Px,t\x){x\x «) \t)(t\T «) Uf^\ipj;){(px\Ulf. 

Then IiX;B) = I{T;B) + I{X;B\T), which is a con- 
sequence of the chain rule, together with the fact that 
liXT; B) = I{X; B) because X ^T. This imphes that 

CW(A^) = sup {I{T-B)^^I{T-E)^) 

{p^,\v^)},X^T 

sup {l{X:B) - I{X;E) 

-{I[X-B\T)-I{X-E\T))). 

Since Af is degradable, and conditional mutual informa- 
tion is monotonic under local operations (LO) when the 
system conditioned on is classical (an immediate conse- 
quence of the LO monotonicity of mutual information, 
itself a consequence of strong subadditivity) , we have 
I{X; B\T) > I{X- E\T), so that 

C«(A^) = sup {I{X;B)-IiX:E)) 

= sup {S{B)-S{B\X)~S{E) + S{E\X)) 

= sup{S{B)- S{E)) 



= snpI{A)B) = Q^'\M). 
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□ 

The following lemma, which shows that Q'-^-' is additive 
for degradable channels, was proved in [9[. We provide 
an alternate proof for both clarity and completeness. 

Lemma 4 For Mi and A2 degradable, 

Proof Let be optimal for Q^^^-^i ® M), 

namely 

We would like to show that 

I{AA[)B2) + I{AA'^)Bi) > I{A)BiB2), (2) 

since this would immediately imply Q^^''(A/i) + 
g(i)(AA2) > Q'^''\Ni® and therefore the theorem. 

In fact, Eq. ([2]) is equivalent to 

I{Bi-B2)>I{EuE2), 

which, is satisfied due to the degradability of Ni and N2 
together with the monotonicity of mutual information 
under local operations. □ 

We are now in a position to prove Theorem 2. 

Proof [of Theorem 2] Let N be degradable. Then, 
from [J , the secret-key capacity of A/" is 

Cp{M) = lim ic(i)(A^^")- 
By Lemma [3] and the degradability of J^f®"^ ^ we have 
Cp(AA) = lim iQ(i)(AA®"), 

n — >oo n 

while Lemma H] gives us Cp{Af) = Q'^^^Af). □ 



III. PRIVATE CLASSICAL CAPACITY WITH A 
SYMMETRIC SIDE-CHANNEL 

Before defining the capacity to be studied, we must first 
formally define the notion of a private classical code. An 
(n, K) key code, C, is a set of K states on A®", together 
with a decoding operation 2?„ : -> {l,...K}. 

The rate of such a code is (logif)/n. Such a code is 
called e-good for a channel VV^"^ (mapping A^" to B'^") 
if, defining 

1 ^ 

Pab»"E«^ = — ^ \x){x\a <E) C/AA(")Pr(tV<"))^ 

x=l 

we have 

1 ^ 

||/A®2?n®/£;®"(PAB»"_E»")--^ X! \x){x\<E)\x){x\(E)Pe\\i < 



We say that a rate R is achievable over A/"®" if for every 
e > and all sufficiently large n there is a a code C„ C 
A®" that is e-good for TV®" with fim„^oo '°^Jf"' > R- 
The private classical capacity of Af is then defined as the 
maximum achievable rate. 

Letting S = Sd C T (g) _L be the d{d + l)/2- 
dimensional symmetric subspace between T and _L and 

Adip) = Tr^ VdpVj 

the d- dimensional symmetric channel. Note that Ad 
maps states on C'i(<i+i)/2 to states on C*. 

The symmetric side-channel assisted private classical ca- 
pacity of a channel Af is simply the private capacity of Af 
when assisted by an arbitrary symmetric channel. More 
formally, we say that a rate R is ss-achievable if for all 
e > and sufficiently large n there is a dn such that R 
is e-achievable over Af^" ® Ad^^ ■ The ss-private classi- 
cal capacity is then the maximum ss-achievable key rate. 
The main result of this work is the following theorem 
characterizing the ss-private capacity. 

Theorem 5 The ss-private capacity of Af is 

C^P% i^) - sup (/(T; BF) - I{T; EG)) , 

(3) 

with the optimization over \ifx)AFG symmetric in FG. 

Note that this expression for Cp^ss is related to but differs 
from the upper bound presented in , which in this case 
translates to 

sup {I{U;BV)~ I{U\EV)) 

{p^,\f:c) a}X^(Ju .X-^crv 

in that the optimization in Theorem [5] is restricted to 
classical T rather than a general ajj- So that besides 
admitting an operational interpretation, our bound will 
in general be tighter. 

A useful alternative characterization of Cp^ss is given by 
C^^is(A^) = supC«(AA®^rf), (4) 

d 

which can be seen to be equivalent to Eq. ^ as follows. 
To see that Eq. ^ can be no bigger than Eq. ([3]), note 
that any ensemble {px, \^x)afg\ with \lPx)afg symmet- 
ric in FG can be generated using Ad with d = dp. Al- 
ternatively, given any ensemble of states, {pxi IVASd)}j 
where Sd is the input to Ad, we retrieve an ensemble 
{px,! ® UAdWASd)} which is symmetric in FG, so that 
Eq. ([3]) is no smaller than Eq. ([4]). 

Before proving the theorem, we provide a multi-letter 
characterization of the capacity. 

Lemma 6 

Gp,ss{Af) = lim -CW,(AA«") 



Proof To see that the ss-privatc capacity is no less 
than the right-hand side, note that for any ensemble 
{Px,\^x) A'^fg} symmetric in FG and X ^ T, a rate 
of 



1 



iI{T;B"F) - I{T; E^^G)) 



is achievable by the coding theorem of 

Conversely, fix e > 0, let { P(^a')"FgJ' ('^; ^) 



ss-private code, and let 
2" 



•FG- 



fe=l 



Then, letting T) be the decoding operation associated 
with the code, 



a^{lT® U^" ® Ifg) oj [It ® (ul f" ® Ifg 



and 



we have 



p = Irp^ Vb^ ® Iefg{(^), 



c <x) Peg 



k=l 



< e. 



As a result, 



> nR-2{2enR + H{e)) , 

where in the last line we have used the continuity result 
of (1^ . Similarly, since ote^-g ~ cft ® oe^t, we have 

I{T- £;"G),^^„^ < 2 {2enR + H{e)) , 

so that 



> nR- 4:{2enR + H{e)) 
= - 8e) - 4i7(e). 



Thus, 



R < ^-i^ ( -CW (AA«") + AH{e] 



1 - 8e V n P' 



□ 

Now using the following lemma, which shows that Cp]}s 
is additive, we will be in a position to prove Theorem [5] 



Lemma 7 Cp]}s is additive: 

Proof For any \(f>x)AiA2FG symmetric in FG and X 
T, let 



B2E2FGC1 C2 



-=(^Ia^ (8> U^r2 (g> Ifg\(I>x)\01) C1C2 



V2 

{I A,® SWAP B2E2® Ifg) I a,<»U^2<»Ifg\<I>x)\10)c\C2):, 

and 01 =E.,tP(a^,^)l^>(^l<»0i■ 
Then, labeling Fi = B2FC1 and Gi = E2GC2, we have 

Cl%iJ^i) > I{T\BiFi)if^j^^f^n^^i) - I{T;EiGi)itg,j^^tg,i{ct,^) 

^ O I '^1^2-F)/<g)M'»A^2'»-r(0) + ^(^; -5l£'2-F)/<g)Ari«,A^2«,7(0) 



/(T; i?li?2G)/^jv'i«)A/'2«>/(0) ~ -^(^; -E'l-^2G)7^_v'i«iA/'2«i/ 



(0) 



Similarly defining we find 



I{T; Sii?2-F)/(giMi»A/'2(»/(0) + ^(^; EiB2F)i(g,j\fi(g,j\f^, 



—I{T] -Bi-E2G)7^A/-j^A/'2«>/(0) — ^(^; EiE2G)i(g,j^^(g,^f^(g,j(^ct,) 

so that 

C«.(AAi)+GW,(AA2)> 
/(T; i?iS2^')/(giAAi«iAA2«i/(0) " -^(T"; EiE2G)jig)j^^0j^^0j(^^). 

Since this is true for any l^^^), we have 

□ 

Proof [of Theorem [5] By Lemma [6l we have 
Cp,..(AA) = hm icW,(AA«"), 

whereas Lemma [7] implies G^^L(7V®") = 7iG^i,(7V), 
which gives the result. □ 

We now show that Gp^ss is convex, a property that the 
unassisted private classical capacity is not known to pos- 
sess. 
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Lemma 8 Cp^ss *s convex: 

Proof LcttingAA= (1-p)AAo®|0)(0|b,+pM<8)|1)(1|b2, 
we consider the purification of J\f that gives Eve the which 
channel information in a system E2 ■ Noting that for any 
Af and M, Cp,ss(7V) > Cp^^siM oAf),we have 

Cp,ss {{I - pWq + pMi) 



< Cp.ss ((1 -p)AAo® |0)(0|s, +pMi ® |1>(1|bJ 

sup (/(T; BB2F) - I{T; EE2G)) 

{p^.\v^)},X-.T 

sup \y^p^[S{T\EG,a)-S{T\BF,a)]\ 

1 

< Vp„ sup {S{T\EG,a)~ S{T\BF,a)) 

a=0 {P:.,|V^>},X-T 

1 

= y^^PaCp,ss{Ma), 

where the \(p^) are taken to be on A' EG and symmetric 
in EG throughout. □ 

Finally, wc demonstrate that the ss-private-capacity of a 
degradable channel is, in fact, the single-letter optimized 
coherent information. 

Lemma 9 If M is degradable, Cp^ssi^f) = (3'^'(7V). 

Proof For any d and degradable Af, it is also the case 
that A/"® Ad is degradable. As a result, 

G^p^\N®Ad) = Q^'\N®Ad) 

- Q^^\N-) + Q^'\Ad)^Q^'\M), 

so that, by the characterization of Cp,ss in Eq.Q, we 
haveCp,..(AA) =Q(i)(AA). □ 

We will now use the convexity of Cp^ss to show that the 
following quantity, which we call the cost of degradable 
mixing, is an upper bound for Gp. 

Definition 10 We define the cost of degradable mixing 
as 

Cdm(AA) = inf y2p^Q^'H^f^), 
where the infimum is over {pi,A/i,I?i} such that 

i 

and each Afi is either degradable or anti- degradable. 
That is, we will prove the following theorem. 



Theorem 11 The cost of degradable mixing of a quan- 
tum channel is an upper bound for its private classical 
capacity. In other words, Cp{Af) < Cdm(A/'). 

Notice that, by restricting our A/i to be either the identity 
channel or be both degradable and anti-degradable, we 
would recover the upper bound of (isj . 

Proof Let Af = J2i PiT^i o A/i be a decomposition of M 
with each A/i either degradable or anti-degradable. Then, 
noting that Cp{N) < Cp^ss{J^), and using the convexity 
of Cp^ss, we have 

Cp(AA) < Cp,,, (^p^V,oJv}j 

< ^KCp,,,(I?,oAA,) 

i 

< ^KCp,,^(A/;) 

i 
i 

where in the last line we have used the fact that for A/i ei- 
ther degradable or antidegradable, Gp^ssiAfi) = Q^^^Afi). 

a 

One might wonder about the inclusion of T>iS in the def- 
inition of the cost of degradable mixing — wouldn't the 
bound be tighter if they were all chosen to be the iden- 
tity? The trouble is that not all channels can be writ- 
ten as a convex combination of degradable and anti- 
degradable channels, but any channel can be decomposed 
into the form required by our definition (e.g., choose only 
one term, and let A/i = / and 2?! = A^, the channel of in- 
terest ). In particular, while all extremal qubit channels 
are either degradable or antidegradable (or both) , and 
therefore any qubit channel can be written as a convex 
combination of such channels, the same is not true in 
higher dimension. For example [27|. the tensor product 
of two extremal qubit channels, one degradable and the 
other anti-degradable (but neither both), is generically 
an extremal channel on two qubits, but is neither degrad- 
able nor anti-degradable, and in light of its extremality 
cannot be decomposed into such channels. To get around 
this, we include the T>iS in the definition of the cost of 
degradable mixing. In the two qubit example, we find 
Cdm is exactly equal to the quantum capacity of the 
degradable channel, and therefore so is the private capac- 
ity, incidentally providing an example of a nondegradable 
channel for which the private and quantum capacities co- 
incide. 



IV. SOME SPECIFIC CHANNELS 

Theorem [TT] gives us a technique for bounding the private 
capacity of a general channel, Af, in terms of the private 
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capacity of a set of dcgradable channels appearing in a 
convex decomposition of M. We now use this method to 
provide upper bounds for the key capacity of two chan- 
nels of interest for quantum key distribution — the Pauli 
channel with independent phase and amplitude noise and 
the depolarizing channel. The resulting bounds meet or 
exceed all previously known bounds on the private clas- 
sical capacity of these channels ^ISj, [H, [O, ■ 



A. Degradable Channels 

In this subsection we explicitly evaluate the private ca- 
pacity of some degradable channels. 

A qubit channels with two Kraus operators has, up to 
local unitaries, Kraus operators equal to [l9[ 

It was shown in [20j that any such channel is either 
degradable or anti-degradable. The private capacity of 
such a channel is thus the optimized single-letter coher- 
ent information: 

Cp{M^^,5))= max [Hit{l--f)+il-t)6)-H{t^+{l-t)S)]. 
te[o,i] 

This result includes the dephasing and amplitude damp- 
ing channels as a special case: setting 7 = gives an 
amplitude damping channel, whereas setting j — S gives 
the bitflip channel (which is unitarily equivalent to a de- 
phasing channel) [28| . 

The erasure channel with erasure probability p, which 
maps C'' into © |e), acts as 

This channel is also degradable, and as a result its pri- 
vate classical capacity is exactly equal to its quantum 
capacity: 

C,(AAg,X°) = (l-2p)logd. 



B. Independent Phase and Amplitude errors 

The Pauli channel with independent amplitude and phase 
noise is an interesting case because of its relation to 
BB84, and also because it's easy to write as a convex 
combination of degradables — it's just an equal mixture 
of two amplitude damping-type channels. 

Written explicitly, the channel we are considering is 

A^(9(i-g),g^g(i-g))(p) = i'^-q{2-q))p + qil-q)X pX 

+q^YpY + q{l-q)ZpZ, 



which can also be written as 

1 ^_^ampdamp ([/t ^[7) [/t + ^ ^ j(^_^ampdamp [XU^ pU X)XU\ 

where U = e'^^ and 7^ = 4g(l — q). 

From the previous subsection, the private capacity of an 
amplitude damping channel with noise parameter 7 is 

/(7) = max {H{t[l - 7)) - H{t-i)) , 

46 [0,1] 

SO that 



Cp(-^(9(l-9),g=, 9(1-9))) < filq)- 

This gives a threshold of k (j- ^ beyond which no 
key can be generated, which is the same as found for 
BB84 in[l3 , and also confirmed in [31 and We can 
also write the J^(q{i-q),q^ ,q{i-q)) as a convex combination 
of dephasing channels with dephasing probability q{2~q), 
which results in slightly tighter bounds for very small 
noise (i.e., q < 0.02). Our combined upper bound on key 
rate is given by 

Cp(7V(,(i_,),52^^(i_g))) < conv (1 - H{q{2 - g)), 7(7,)) , 

_ (5) 

and tightens the previous best bounds of [1^ (which 
considered only protocols without noisy processing), and 
the (straight line) bound found in [1^ for all < g < 

i ^1 ~ -j^ ^ ( see Figure [T|). The fact that we surpass the 

bound of [16| is particularly interesting, since it is also 
an achievable key rate against an adversary restricted to 
individual attacks. Our bound thus shows that a com- 
pletely general attack is strictly stronger than an indi- 
vidual attack. 



C. Depolarizing channel 

A depolarizing channel with error probability p is a con- 
vex combination of six amplitude damping channels with 
error parameter 

rjp - 4v/r^ (1 - v/r^) 

(see for details). It is also a convex combination of 
three dephasing channels with error probability p. Fi- 
nally, the secret key capacity is zero whenever a channel 
is antidegradable, which happens at p = 1/4 [2l|, so that 
the convexity of Cp,ss then implies 

Cp,sA^p) < conv (1 - H{p), f{r,p), (1 - Ap)+) , 

where we have let a;+ = a; if a; > and otherwise. This 
expression is equal to the upper bound on the depolar- 
izing channel's quantum capacity found in so that 
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the best known upper bounds for this channel actually 
coincide. 

It is worth mentioning that the bound on the thresh- 
old for the six-state protocol reported in [l^ is strictly 
stronger than the p = 1/4 threshold implied by our 
bound. However, the [isj bound does not apply to the 
private capacity of the depolarizing channel, since it is 
valid only for a restricted set of input states. 

For comparison with the QKD literature, note that the 
relationship between quantum bit error rate, g, and de- 
polarizing error probability, p, is q ~ 2p/3. 



1.2 
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FIG. 1: Bounds on the key rate of BB84 with one-way post- 
processing as a function of quantum bit error rate, q. The 
lower curve is the best known achievable key rate from [lll.fl^. 
The upper curve is the "optimal eavesdropping"' bound on 
BB84 {without noisy processing) found in [10], representing 
the best possible individual attack. The middle curve is our 
upper bound from Eq. ([5]). 



D. Pauli Channel 

For a general Pauli channel we find the following bound. 
Theorem 12 Let 

A/p(p) = il-\p\)p + PiXpX+p2YpY+p3ZpZ. 
Then the private classical capacity of Hp satisfies 

Cp(AAp)<l-i7(|p|), 
where |p| ^pi+P2+P?.- 
Proof Letting = Pi/|p|, we have 



where we have let Mp{p) = (1 ~ p)p + pXpX, and sim- 
ilarly for Afp and Afp . This is a convex combination of 
dephasing-like channels with error probability |p|, which 
are degradable and have a private capacity of 1 — iJ(|p|), 
so that by Theorem [TT] we have the result. □ 

It is not entirely clear how to best decompose a Pauli 
channel into a convex combination of amplitude damp- 
ing channels, but it seems likely that such a decomposi- 
tion (or perhaps a decomposition into channels with two 
Kraus operators) would outperform the current bound 
for high noise levels. 



E. Relationship to collective attacks in QKD 

In this subsection we describe how the above upper 
bounds on the private capacity correspond to collective 
attacks on quantum key distribution protocols. Consider 
the decomposition of a channel Af into a convex combi- 
nation of degradable channels, A/i: 

i 

where we will call the isometric extension of Afi U_\f^ : 
A BE. The attack associated with this decomposi- 
tion is as follows: For each signal state sent. Eve applies 
U^f- with probability pi, sends the B system to Bob, and 
stores her various E systems until the end of the proto- 
col. After the protocol is complete. Eve collects all of 
her E systems associated with Afi and (jointly) measures 
which of the typical eigenvectors of p^^'" the state is in. 
Because Afi is degradable, we can calculate exactly how 
much secret key Alice and Bob can distill from the result- 
ing state — they can get a key rate of exactly Q^^^Afi). 
Because a fraction pi of the signal states are subjected to 
A/i, the overall key rate is no more than '^iPiQ^^'' {J^i)- 



V. DISCUSSION 

We have studied the capacity of a quantum channel for 
private classical communication when assisted by sym- 
metric channel of an arbitrary size. For a general chan- 
nel, we found a single letter formula that, unfortunately, 
involves an optimization over an auxiliary space that is 
a prior unbounded. For degradable channels, we further 
showed that this optimization can be performed explic- 
itly, and in fact the ss-private capacity of such a channel 
is exactly equal to its single-letter optimized coherent in- 
formation. Using this fact, together with the convexity of 
the ss-capacity for general channels, we showed how to 
find upper bounds on the (unassisted) private capacity 
of a general channel, and provided such bounds for two 
channels of interest for quantum key distribution. 

The most important question we have left unanswered 
is whether it is possible to bound the dimension of the 
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symmetric channel necessary to achieve the optimum of 
the ss-capacity formula found in Theorem [5l This could 
allow very tight bounds on the unassisted capacity. In 
fact, we are unaware of any channel for which the ss- 
private capacity and unassisted private capacity differ, 
and the conjecture that they arc the same is equivalent 
to the additivity of the unassisted capacity, Cp. 

We note that for both the independent amplitude and 
phase noise and the depolarizing channel, the upper 
bounds are the convex hull of a bound based on decom- 
position into dephasing channels, which is strongest in 
the low noise regime, and a decompostion into amplitude 
damping channels, which is stronger in the high noise 
regime. This suggests that the best collective attacks on 
quantum key distribution protocols will be qualitatively 
different in the high and low noise regimes. 

It is an interesting question whether there are zero capac- 
ity degradable channels that are not antidegradable. This 
possibility is intriguing, since the best known bounds on 
the zeros of the capacity of most channels come from 
a no-cloning argument (which is essentially to observe 
that the channel is antidegradable), but these bounds 
are usually not particularly close to the corresponding 



lower bounds. Such a channel would also be useful for 
improving estimates on Cum for general channels. 

Finally, this work demonstrates (along with Q ) that 
assistance from a symmetric side channel is a "nice" re- 
source, in the sense that it provides a marked simplifi- 
cation over the unassisted case for the private capacity. 
Further examples of nice resources are free EPR pairs, 
which lead to the single-letter formula for the entangle- 
ment assisted capacity of [1^ H^, and PPT-preserving 
operations, which dramatically simplify the theory of en- 
tanglement manipulations [2J, [2^ . What are the other 
"nice" resources? 
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